Security & Trust
What Custodyn controls.
What it doesn't.
We believe in being transparent about what our platform does and doesn't do. This page explains our security controls, data handling, and the limits of what Custodyn can enforce.
What Custodyn controls
These are enforced by Custodyn when your agents are connected via SDK, Gateway, or MCP.
Policy enforcement
Every agent action is checked against your policy rules before it executes. Block, require approval, or allow — your rules, enforced automatically.
✅ Implemented
Human approval gates
High-risk actions require a human to approve before the agent can proceed. Approvals can be set to expire and auto-deny if not acted on.
✅ Implemented
Tamper-evident audit logs
Every action is logged with a SHA-256 hash. Logs cannot be altered after recording. Full export available for SOC2 and compliance reviews.
✅ Implemented
Prompt injection detection
Custodyn scans agent inputs for injection attempts — malicious prompts designed to override your agent's instructions.
✅ Implemented
Multi-tenant isolation
Every company's data is strictly isolated. No cross-tenant access is possible. All database queries are scoped to your company ID.
✅ Implemented
Kill switch
Pause all your agents instantly with one click. No new actions will be processed until you resume. Available 24/7 from your dashboard.
✅ Implemented
SSRF protection
The Gateway proxy blocks requests to private IP ranges, localhost, and cloud metadata endpoints (169.254.169.254 etc) to prevent server-side request forgery.
✅ Implemented
Rate limiting
All API endpoints are rate limited per plan tier. Auth endpoints have additional brute-force protection. Limits are stored in the database, not memory.
✅ Implemented
What Custodyn cannot control
Being honest about our limits is important. Custodyn only enforces what passes through our SDK or Gateway.
Agents not connected to Custodyn
If an agent doesn't use our SDK or Gateway, we have no visibility into its actions. Custodyn cannot enforce policies on unconnected agents.
Not enforceable
LLM model behaviour
Custodyn intercepts tool calls and actions — not the underlying LLM's reasoning. We cannot control what the model thinks or decides, only what it does.
By design
Direct API calls bypassing Gateway
If an agent calls an external API directly (not through our proxy), Custodyn cannot intercept or block it. The Gateway must be the routing layer.
Not enforceable
Local file system actions
Actions taken directly on a local file system without going through the SDK are not visible to Custodyn unless explicitly instrumented.
Not enforceable
Data handling
What we store, how long we keep it, and how it's protected.
| Data type | What we store | Retention | Encrypted |
|---|
| Action logs | Action name, category, target, outcome, timestamp, agent ID | 7–∞ days (by plan) | ✓ In transit |
| Passwords | bcrypt hash only — never plaintext | Until account deleted | ✓ Hashed |
| API keys | Full key stored — treat like a password | Until regenerated | ✓ In transit |
| Webhook URLs | Slack/Teams/PagerDuty webhook URLs | Until removed | ✓ In transit |
| Action payloads | Not stored by default unless explicitly logged | N/A | N/A |
| LLM prompts/outputs | ✗ Not stored | N/A | N/A |
Compliance
Where we are today and what's coming.
SOC2-compatible audit export
Export your full audit log in SOC2-compatible JSON or CSV format at any time from Settings. Includes all actions, outcomes, timestamps and agent IDs.
✅ Available on Pro+
HIPAA-ready controls
Custodyn implements technical controls aligned with HIPAA requirements — access control, audit logging, tamper-evidence, and human approval gates. Note: Custodyn is HIPAA-ready, not HIPAA certified.
✅ Available on Enterprise
GDPR
We store only what's necessary to operate the service. You can request deletion of your data at any time by contacting us. Data is processed in accordance with GDPR principles.
⚠️ In progress
SOC2 Type II certification
Formal SOC2 Type II audit is planned once we reach sufficient scale. The technical controls are already in place.
🗓 Planned
Frequently asked questions
Common questions from security and compliance teams.
Can Custodyn see my agent's prompts or LLM outputs?
▾
No. Custodyn only sees the tool calls and actions your agent takes — not the underlying prompts, reasoning, or LLM outputs. We intercept at the action layer, not the model layer.
What happens if Custodyn's server goes down?
▾
By default the SDK operates in fail-closed mode — if it cannot reach the Custodyn server, it blocks the action rather than allowing it through. You can configure fail-open mode for development environments if needed.
Can an agent bypass Custodyn?
▾
If an agent uses our SDK, it can only bypass Custodyn if the developer intentionally removes the SDK integration. The Gateway proxy provides harder enforcement — actions literally route through Custodyn before reaching their destination. Agents that don't go through either integration are not covered.
Where is data stored?
▾
Data is stored in a SQLite database on Railway's infrastructure (hosted on AWS). Enterprise customers can request data residency requirements — contact us to discuss.
How do I report a security vulnerability?
▾
Please email us at
security@custodyn.app. We aim to respond within 24 hours. We do not have a formal bug bounty programme yet but we acknowledge all responsible disclosures.
Do you sell or share data with third parties?
▾
No. We do not sell, rent, or share your data with third parties. Webhook URLs you configure (Slack, Teams, PagerDuty) are used only to send notifications you've requested.